chore(deps): update dependency picomatch@<2.3.2 to v4

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
picomatch@<2.3.2	>=2.3.2 → >=4.0.7

---

Release Notes

micromatch/picomatch (picomatch@<2.3.2)

v4.0.7

Compare Source

Fixed

• Fixed terminal globstars in parenthesized patterns (#​142, e279bd7).

v4.0.6

Compare Source

Fixed

• scan() now scans the full pattern when tokens are requested, instead of merging the remaining path segments into the final token (#​62, 5f5819d).
• scan() now returns complete pattern parts, including leading and trailing empty segments, and handles nested and escaped parentheses correctly (#​58, f201165).

v4.0.5

Compare Source

Fixed

• Preserved every branch when safely rewriting repeated extglobs (#​182, 6289307).
• Honored the windows option when matching basenames (#​183, ab8bc4d).

v4.0.4

Compare Source

Security

• Prevented regular expression denial of service (ReDoS) from crafted repeated or nested extglob quantifiers by safely rewriting or treating risky patterns as literals. The new maxExtglobRecursion option defaults to 0; positive numeric values allow limited nesting, while false disables the safeguard (CVE-2026-33671, 5eceecd).
• Prevented inherited object properties from being interpreted as POSIX character classes (CVE-2026-33672, 4516eb5).

v4.0.3

Compare Source

Fixed

• Avoided an exception when a glob pattern contains constructor (#​144, a9e2dd2).

v4.0.2

Compare Source

Changed

• Moved Windows platform detection to the shared utilities (f7751de).
• Updated development dependencies (d958901).

v4.0.1

Compare Source

Breaking changes

• Raised the minimum supported Node.js version from 10 to 12 (6ce95f5).

v4.0.0

Compare Source

Breaking changes

• On supported Node.js versions, 4.0.0 does not remove any public matcher API or change matching semantics. Its compatibility change is the removal of Picomatch's Node.js version check for regular expression lookbehinds. Runtimes without native lookbehind support, which are outside the supported Node.js range, now use the standard toRegex() behavior: a non-matching fallback by default and the native RegExp error when debug: true (#​129, 907d706).

Fixed

• Preserved complete text values when parse() combines adjacent text tokens (#​100, #​125, #​126, 563f534). Thanks to @​connor4312.

Changed

• Removed the Node.js os dependency from the main entry point to support browser environments (#​124, b0ff9b1). Thanks to @​gwsbhqt.
• Added sideEffects: false to package.json (#​128, 8f18eb6). Thanks to @​frandiox.
• Restored all properties from the core matcher, including the undocumented picomatch.constants, on the package's main export (335eac6).

v3.0.2

Compare Source

Fixed

• Avoided an exception when a glob pattern contains constructor (#​144, 8c08b94).

Security

• Backported the extglob-quantifier ReDoS fix from 4.0.4. Risky repeated extglobs are now safely rewritten or treated as literals by default; positive numeric maxExtglobRecursion values allow limited nesting, while false disables the safeguard (CVE-2026-33671, 05c0743).
• Prevented inherited object properties from being interpreted as POSIX character classes (CVE-2026-33672, 0bdde35).

v3.0.1

Compare Source

Breaking changes

• Raised the minimum supported Node.js version from 8.6 to 10 (5214db4).

v3.0.0

Compare Source

Breaking changes

• Windows path-separator handling in the core and static APIs is now controlled by the windows option instead of automatic platform detection. Calls without an options object use POSIX behavior; pass windows: true when backslashes should be treated as path separators. The main picomatch() entry point applies platform detection only when an options object is provided (#​73, 49d10c4).
• The undocumented picomatch.constants property is no longer copied to the package's main export (7e120bb). It is restored in 4.0.0 (335eac6).
• The v3 matchBase() implementation did not forward Windows mode to its platform-independent basename helper. As a result, backslash-separated inputs did not match by basename, even with windows: true. This is fixed in 4.0.5 (#​183, ab8bc4d).

Added

• Added the dependency-free picomatch/posix entry point for browser and other non-Node.js environments. It uses POSIX path semantics unless windows: true is passed (7e120bb).

Changed

• Removed the Node.js path dependency and automatic process.platform detection from the core matcher, and documented the existing windows option (#​73).

---

Configuration

📅 Schedule: (in timezone Europe/Zurich)

• Branch creation
  • Between 12:00 AM and 03:59 AM, on day 1 of the month (* 0-3 1 * *)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 6f7c903

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR